From: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <oshumeik@cisco.com>
Date: Tue, 6 Dec 2022 11:44:45 +0000 (+0000)
Subject: Pull request #3693: js_norm: update PDF tokenizer to use glue input streambuf
X-Git-Tag: 3.1.49.0~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1c45ba157bc7616cef79f871e2adfd3eeac74b72;p=thirdparty%2Fsnort3.git

Pull request #3693: js_norm: update PDF tokenizer to use glue input streambuf

Merge in SNORT/snort3 from ~OSERHIIE/snort3:js_pdf_fixup to master

Squashed commit of the following:

commit a1ea7641078ab9622838882605cfd2ffbf012e84
Author: Oleksandr Serhiienko <oserhiie@cisco.com>
Date:   Mon Dec 5 15:08:20 2022 +0100

    js_norm: fix pdf_tokenizer_test on FreeBSD platform

commit af4be627c44f45dcae8fc24fe085ff4c03d972bf
Author: Oleksandr Serhiienko <oserhiie@cisco.com>
Date:   Mon Dec 5 15:05:54 2022 +0100

    js_norm: update PDF tokenizer to use glue input streambuf

        * js_norm: update PDF tokenizer EOF rule to cover all starting conditions
        * http_inspect: update PDF JSNorm to use istreambuf_glue
---

diff --git a/src/js_norm/pdf_tokenizer.l b/src/js_norm/pdf_tokenizer.l
index 181c21959..20d497ee6 100644
--- a/src/js_norm/pdf_tokenizer.l
+++ b/src/js_norm/pdf_tokenizer.l
@@ -189,7 +189,7 @@ WHITESPACE        {GRP_WHITESPACE}{1,64}
 <jshstr>{HEX_STR_BODY}                            { EXEC(h_hex_hex2chr()) }
 <jshstr>{HEX_STR_SKIP}                            { }
 
-<<EOF>>                                           { return PDFRet::EOS; }
+<INITIAL,dictnr,litstr,hexstr,jslstr,jshstr><<EOF>>    { return PDFRet::EOS; }
 
 %%
 
diff --git a/src/js_norm/test/pdf_tokenizer_test.cc b/src/js_norm/test/pdf_tokenizer_test.cc
index b2986538b..13eb326ca 100644
--- a/src/js_norm/test/pdf_tokenizer_test.cc
+++ b/src/js_norm/test/pdf_tokenizer_test.cc
@@ -58,7 +58,7 @@ static void test_pdf_proc(const vector<Chunk>& chunks)
         auto src = chunk.first;
         auto exp = chunk.second;
 
-        in.rdbuf()->pubsetbuf((char*)src.c_str(), src.length());
+        in.str(src);
         out.str("");
 
         auto r = extractor.process();
diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc
index bacc34a68..1936047eb 100644
--- a/src/service_inspectors/http_inspect/http_js_norm.cc
+++ b/src/service_inspectors/http_inspect/http_js_norm.cc
@@ -453,7 +453,9 @@ bool HttpPDFJSNorm::pre_proc()
     }
 
     // an input stream should not write to its buffer
-    pdf_in.rdbuf()->pubsetbuf(const_cast<char*>((const char*)src_ptr), src_end - src_ptr);
+    buf_pdf_in.pubsetbuf(nullptr, 0)
+        ->pubsetbuf(const_cast<char*>((const char*)src_ptr), src_end - src_ptr);
+
     pdf_out.clear();
     delete[] buf_pdf_out.take_data();
 
diff --git a/src/service_inspectors/http_inspect/http_js_norm.h b/src/service_inspectors/http_inspect/http_js_norm.h
index 1b750f0e1..ff6945e47 100644
--- a/src/service_inspectors/http_inspect/http_js_norm.h
+++ b/src/service_inspectors/http_inspect/http_js_norm.h
@@ -102,7 +102,7 @@ public:
     }
 
     HttpPDFJSNorm(JSNormConfig* jsn_config, uint64_t tid) :
-        HttpJSNorm(jsn_config), pdf_out(&buf_pdf_out), extractor(pdf_in, pdf_out)
+        HttpJSNorm(jsn_config), pdf_in(&buf_pdf_in), pdf_out(&buf_pdf_out), extractor(pdf_in, pdf_out)
     { trans_num = tid; }
 
 protected:
@@ -110,8 +110,9 @@ protected:
     bool post_proc(int) override;
 
 private:
+    snort::istreambuf_glue buf_pdf_in;
     snort::ostreambuf_infl buf_pdf_out;
-    std::istringstream pdf_in;
+    std::istream pdf_in;
     std::ostream pdf_out;
     jsn::PDFTokenizer extractor;
 };